The present invention relates to a method and an arrangement for monitoring manipulations on computers which are connected via a network.
Manipulations on computers are intended to refer in particular to changes to executable programs by non-authorized persons, that is for example the "infecting" of computers with "viruses" or "Trojan horses".
To check whether manipulations have taken place on a computer, the following possibilities are known:
Regular manual inspection of the databases. This effort is justified only for cases particularly at risk or relevant to security.
The use of classified operating systems. Classified operating systems are those which correspond to the American "Trusted Computer System Evaluation Criteria", the German "IT-Sicherheitskriterien" (IT Security Criteria) or similar codes of practice. Classified operating systems have, starting from certain classes, built-in security levels which hinder manipulations. For example, from Class B2 of the abovementioned "Trusted Computer System Evaluation Criteria", so-called "access control lists" are prescribed, which allow a finer graduation of write privileges. Prescribed protocol files facilitate the detection of manipulations, but do not prevent them. If an intruder succeeds nevertheless in acquiring the appropriate privileges, he can manipulate files just as in conventional systems.
Sealing of files and file directories by signatures and checking upon access. Such sealing is known, for example, from German reference 3,736,760 or from European Patent 0,137,075. In order to achieve adequate security, checking of the sealing cannot be performed at the user level but must be carried out by an operating system specifically modified for this. It is assumed here that the operating system is not manipulated by an intruder. This method remains problematical if the sealing can be produced on the computer itself, because then an intruder can himself produce new seals for the manipulated files. In the IBM operating system MVS it is possible, for example, to protect against manipulation by only allowing marked files to be altered after agreement by the system manager. This possibility, however, requires a great system-administrative effort in order for the agreement of the system manager to be always possible at the suitable time.
Automation of routine inspection which attributes of databases of the computers are automatically inquired and compared with protectedly stored reference values of the attributes and in which, in the event of non-correspondence, an alarm is triggered. Checksums or other attributes concerning the files to be protected are stored on the computer to be monitored in a protected file and verified at regular intervals by a program. This method is desirable insofar as it means no personnel effort and makes do without intervention in the operation system. It has the disadvantage, however, that it does not offer suitable protection against intruders. Once an intruder has gained access to the computer, he will tend to inform himself as to which security mechanisms there are. One of the first manipulations would be to eliminate these protective mechanisms, since the automatic inspection virtually cannot be concealed. This is generally practicable for the intruder because the program which is intended to verify the files to be protected is on the computer itself and is consequently open to manipulations.